Vulnerability · Published Jan 20, 2025 · Assigned by GitHub_M

CVE-2025-24013CodeIgniter validation of header name and value

Medium 5.3

In plain English

A medium-severity security flaw in CodeIgniter4 from codeigniter4. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application. This vulnerability is fixed in 4.5.8.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	codeigniter4/framework	4.5.8	GHSA-x5mq-jjr3-vmx6

Affected products (as reported)

Vendor	Product	Versions
codeigniter4	CodeIgniter4	< 4.5.8

Weakness: CWE-436 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-x5mq-jjr3-vmx6 x_refsource_CONFIRM
https://github.com/codeigniter4/CodeIgniter4/commit/5f8aa24280fb09947897d6b322bf1f0e038b13b6 x_refsource_MISC
https://datatracker.ietf.org/doc/html/rfc7230#section-3.2 x_refsource_MISC
https://github.com/advisories/GHSA-wxmh-65f7-jcvw x_refsource_MISC